diff --git a/gdm-autologin-pam b/gdm-autologin-pam
index 3df6046..42b85d8 100644
--- a/gdm-autologin-pam
+++ b/gdm-autologin-pam
@@ -5,9 +5,9 @@ account    required    pam_nologin.so
 account    include     system-auth
 password   include     system-auth
 session    required    pam_selinux.so close
-session    optional    pam_keyinit.so force revoke
 session    include     system-auth
 session    required    pam_loginuid.so
 session    optional    pam_console.so
 session    required    pam_selinux.so open
+session    optional    pam_keyinit.so force revoke
 session    required    pam_namespace.so
diff --git a/gdm-pam b/gdm-pam
index 9fc6e69..e3efd67 100644
--- a/gdm-pam
+++ b/gdm-pam
@@ -7,11 +7,11 @@ account    required    pam_nologin.so
 account    include     system-auth
 password   include     system-auth
 session    required    pam_selinux.so close
-session    optional    pam_keyinit.so force revoke
 session    include     system-auth
 session    required    pam_loginuid.so
 session    optional    pam_console.so
 session    required    pam_selinux.so open
+session    optional    pam_keyinit.so force revoke
 session    required    pam_namespace.so
 session    optional    pam_gnome_keyring.so auto_start
 
diff --git a/gdm.spec b/gdm.spec
index 9debc91..c28b970 100644
--- a/gdm.spec
+++ b/gdm.spec
@@ -16,7 +16,7 @@
 Summary: The GNOME Display Manager
 Name: gdm
 Version: 2.20.1
-Release: 1%{?dist}
+Release: 2%{?dist}
 Epoch: 1
 License: GPLv2+
 Group: User Interface/X
@@ -361,6 +361,9 @@ fi
 %{_datadir}/pixmaps/faces/extras/*.jpg
 
 %changelog
+* Wed Oct  17 2007 Dan Walsh <dwalsh@redhat.com> - 1:2.20.1-1
+- Change pam config so keyinit happens after pam_selinux open
+
 * Tue Oct 16 2007 Matthias Clasen <mclasen@redhat.com> - 1:2.20.1-1
 - Update to 2.20.1